ClickFix fake error message malware spikes over 500%, takes second place as the most abused attack vector

• ClickFix is increasingly being used to install infostealers
• The attack vector saw a 500% rise over the past 6 months
• Users are told to run commands in Powershell to fix an error

Use of the ClickFix attack vector has shot up by 517% since the second half of 2024, making it the second most abused attack vector behind phishing.

The attack uses a fake reCAPTCHA to trick users into running code in a Powershell terminal as a ‘fix’ to a fake error.

This causes malware and infostealers to be downloaded and executed on the target device, which then harvest and extract sensitive data back to the hackers.